The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
It was discovered that Kibana was not sanitizing document fields containing HTML snippets. Using this vulnerability, an attacker with the ability to write documents to an elasticsearch index could inject HTML. When the Discover app highlighted a search term containing the HTML, it would be rendered for the user.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Elastic Kibana | — | Upgrade Elastic Kibana to the latest version | Sep 3, 2025 | Nov 18, 2022 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub